Internet age verification

[IvanV]

I thought I'd start a topic for this, rather than continue the discussion in the Bluesky thread.

I agree that age verification is needed. But the way it has been implemented in this country is just crap. Of course the previous government passed a piece of crap legislation, it's what that crap government did. But the present government, who are increasingly crap, one just implemented it seemingly not noticing that it was crap.

It's not just that there is no regulation of the propriety of the people carrying out the age verification, so who in their right mind would give their credentials to those people. But also that it's so very easy to sidestep.

I'm surprised it has taken almost a month people to notice it so very easy to sidestep (BBC). We hear the government has no plans to regulate VPNs. I don't know what the right approach to that ought to be.

Can't we be grown-up about this and do it properly, so that it happens, but we don't get risk identity theft when doing it? I cited the Germans before, who regulate the age verifiers. But I don't know if they fixed the VPN switcheroo.

[Opti]

I haven't had any trouble here on the beach (well, indoors actually - it's too f.cking hot ) but obviously I haven't got such a thing. I haven't even seen what these things look like.
I use my VPN to access uk sites that require it, but haven't been asked to do the age thing. Perhaps I don't look at the necessary sites?

[dyqik]

It's not possible to fix the VPN sidestep without closing off the entire Internet, Great Firewall of China style.

The modern Internet, and virtually every large corporation, runs on encrypted network traffic. Any effective attempt to prevent personal VPNs stops most business from doing business in the UK.

At the very lowest level, you can build a makeshift VPN with a proxy server outside the UK, and an SSH tunnel to that proxy server. Preventing that requires preventing secure terminal connections to any computer outside the UK.

For example, I wouldn't be able to travel to the UK for work, and do any of my work remotely. I need a VPN to fill in my timesheets, remote SSH access to log into the telescope I help run, to access documents, etc.

[bjn]

Legislation that ignores basic engineering realities is fundamentally stupid legislation. Then you have the regulator basically saying “ban first ask questions later” and whole chunks of information are being put behind walls. The cherry on top is the idiocy of completely unregulated age verification and you have an actively harmful piece of legislation.

Labour could have done a “This is a poorly drafted piece of Tory legislation that we will revise.” and come up with something better.

All a classic case of “Something must be done! This is something! Let it be done!”.

I despair.

[Martin Y]

I haven't looked into age verification methods yet but the news that the providers of this are not themselves regulated sounds utterly dunderheaded.

It would be like mandating a new type of lock be fitted to everyone's house but then allow a free-for-all where any cowboy can say he's a trustworthy locksmith, his locks are secure and he's definitely not going to sell master keys.

[IvanV]

I haven't looked into age verification methods yet but the news that the providers of this are not themselves regulated sounds utterly dunderheaded.

Under the UK Act, which I have read, the regulation is of the internet site providers, not age verifiers. Internet site providers with relevant content are required to carry out effective age verification, whether themselves or via a verifier. But the primary check is of the effectiveness of the verification. As I said on the Bluesky thread, there is some brief lip-service in the act to the protection of the privacy and other interests of users, but no actual mechanism to test it, protect it or enforce it. The protection of site users is not even mentioned in the guide to the act made by the relevant government body that does this. So they clearly don't think it is their job.

The contrast is with the German system, where it is the age verifiers themselves that are required to be licensed, and internet sites with relevant content are required to use a licensed age verifier. The regulation of the age verifiers specifically aims to protect the privacy of the user and the safety of the data they provide to the verifier. Apparently there are about 3 licensed verifiers doing nearly all of it.

There doesn't seem to be any complaint, that I could find, about the German system. What I don't know is whether that's because everyone knows you just use a VPN to avoid it.

The BBC was reporting that searches for VPN apps spiked massively just as the age protection came in. I expect many people already have VPNs bundled with their virus protector, as that seems to be common functionality for them, if they are using a commercial antivirus package.

[Grumble]

I need a VPN to access my payslip, for some reason. Genuinely don’t know why.

[bjn]

Now there is pressure to come after VPNs.

https://www.bbc.co.uk/news/articles/cn438z3ejxyo

[Chris Preston]

I need a VPN to access my payslip, for some reason. Genuinely don’t know why.

I need to VPN to access anything to do with financial matters at work. Including finding out how much is still left in grants.

[TopBadger]

Trying to go after VPN's will be an uphill battle. They're a security requirement in many cases.

There's that saying that when the only tool you have is a hammer, every problem looks like a nail. Applied to politics that would seem to suggest that when an MP's main tool is to pass law, then every problem looks like it needs a new piece of legislation.

Ultimately I think the way forward is one of education rather than laws. Sex isn't something to be ashamed of and I think the vast majority of young people realize that quite a lot p.rn doesn't represent reality in the same way that quite a lot of feature films also don't represent reality.

But hey, they can now tell the "something needs to be done" crowd that they've done something.

[Sciolus]

Legislation that ignores basic engineering realities is fundamentally stupid legislation.

These are the same people who want encryption to have back doors that the spooks can access but not the bad guys, remember.

[dyqik]

Trying to go after VPN's will be an uphill battle. They're a security requirement in many cases.

One that the government requires and recommends in many cases.

[wilsontown]

As others have mentioned, I need to use a VPN to do my job. I've spent this morning submitting jobs to our data centre in Houston from my laptop in York. Our customers would not be happy (this is an understatement) if I was able to access their data in a non-secure way.

Surely the global interconnectedness of business makes any such proposal a total non-starter.

[IvanV]

Trying to go after VPN's will be an uphill battle. They're a security requirement in many cases.

What we read in these articles is "being demanded" is age verification for accessing VPNs. Though, as usual, when journalists report something is being demanded, they are unclear who is doing the demanding. Is it Mrs Figgis from no 37? Or the editor of the Daily Mail? Or Nigel Farage?* Or a respectable broad-based representative organisation?

Is age verification for VPN access impractical? It will certainly be annoying given that, as you say, many people require them for routine reasons nothing to do with accessing age-sensitive material.

*Reform's attitude to age verification is inconsistent. They are both for it and against it, depending on what today's argument is. On the one hand, they hate any kind of identification or other structures that means big brother or the nanny state is keeping an on us and telling us what we can or can't do. On the other hand, they demand to be an authoritarian ruler, who isn't any kind of big brother or nanny, that keeps an eye on us and tells us what we can and can't do.

[shpalman]

Trying to go after VPN's will be an uphill battle. They're a security requirement in many cases.

What we read in these articles is "being demanded" is age verification for accessing VPNs. Though, as usual, when journalists report something is being demanded, they are unclear who is doing the demanding. Is it Mrs Figgis from no 37? Or the editor of the Daily Mail? Or Nigel Farage?* Or a respectable broad-based representative organisation?

Is age verification for VPN access impractical? It will certainly be annoying given that, as you say, many people require them for routine reasons nothing to do with accessing age-sensitive material.

It's probably easier, given that you need to pay for a VPN in most cases, or it's via your employer who knows who you are. But maybe some shadier VPNs sell themselves on anonymity.

But I'm fairly sure that I've had different experiences with the two VPNs my employer has used in terms of what country Prime Video thought I was in. I'm surprised the streaming services don't give VPNs a harder time given that they're often marketed as ways to get around geo-locking (which is in place because the streaming services don't actually have world-wide rights to everything).

*Reform's attitude to age verification is inconsistent. They are both for it and against it, depending on what today's argument is. On the one hand, they hate any kind of identification or other structures that means big brother or the nanny state is keeping an on us and telling us what we can or can't do. On the other hand, they demand to be an authoritarian ruler, who isn't any kind of big brother or nanny, that keeps an eye on us and tells us what we can and can't do.

This is the general inconsistency you see on the right: I can do whatever I want but you need to do what I tell you.

[Opti]

There's not much in the way of streaming I can't access with a hooky Firestick and a decent VPN (I use ExpressVPN, used to use Nord}.
You're right, the streaming companies and UK 'council telly' stations are very slack in their response to VPNs. Long may it last.

[bjn]

Trying to go after VPN's will be an uphill battle. They're a security requirement in many cases.

What we read in these articles is "being demanded" is age verification for accessing VPNs. Though, as usual, when journalists report something is being demanded, they are unclear who is doing the demanding. Is it Mrs Figgis from no 37? Or the editor of the Daily Mail? Or Nigel Farage?* Or a respectable broad-based representative organisation?

Well the children’s commissioner for England is demanding it…

Dame Rachel de Souza told BBC Newsnight it was "absolutely a loophole that needs closing" and called for age verification on VPNs.

https://www.bbc.co.uk/news/articles/cn438z3ejxyo

[dyqik]

Trying to go after VPN's will be an uphill battle. They're a security requirement in many cases.

What we read in these articles is "being demanded" is age verification for accessing VPNs. Though, as usual, when journalists report something is being demanded, they are unclear who is doing the demanding. Is it Mrs Figgis from no 37? Or the editor of the Daily Mail? Or Nigel Farage?* Or a respectable broad-based representative organisation?

Well the children’s commissioner for England is demanding it…

Dame Rachel de Souza told BBC Newsnight it was "absolutely a loophole that needs closing" and called for age verification on VPNs.

https://www.bbc.co.uk/news/articles/cn438z3ejxyo

Which, as I point out above, essentially calling for age verification on the use of open source encryption software that is built into every modern operating system.

[bjn]

Yep, OpenSSH is everywhere, all secure websites use it.

As I said above, legislation that ignores basic engineering realities is fundamentally stupid legislation.

[jimbob]

It's not possible to fix the VPN sidestep without closing off the entire Internet, Great Firewall of China style.

The modern Internet, and virtually every large corporation, runs on encrypted network traffic. Any effective attempt to prevent personal VPNs stops most business from doing business in the UK.

At the very lowest level, you can build a makeshift VPN with a proxy server outside the UK, and an SSH tunnel to that proxy server. Preventing that requires preventing secure terminal connections to any computer outside the UK.

For example, I wouldn't be able to travel to the UK for work, and do any of my work remotely. I need a VPN to fill in my timesheets, remote SSH access to log into the telescope I help run, to access documents, etc.

Absolutely

[Imrael]

Not directly relevant, but this came up recently. Basically an organisation that does criminal record background checks (DBS) had a data leak.

Register Article - APCS breach

It looks like a supply chain attack via their software developer, and at the moment the parties arent releasing scale or method (which I dont view as good practice, but still..).

The relevance is mostly that the 3rd party services used for age verification will need to be absolutely on top of their security game, but honestly no-one ever is. An eventual breach/leak from one of those providers is not at all unlikely.

[IvanV]

It's probably easier, given that you need to pay for a VPN in most cases, or it's via your employer who knows who you are. But maybe some shadier VPNs sell themselves on anonymity.

VPN has long been available with one click on all the computers in my household, because it's bundled into the fairly cheap 5-device household antivirus package we have. So an adult can pay for it and - potentially unwittingly - make it available to the whole household. You'd need more than ability to pay for it to restrict its availability.

[Grumble]

Skeptics with a K have pointed out that this can have a chilling effect on all sorts of unintended targets. Advice for LGBTQ youth, for example, tends to get classed as if it is “adult” even though it’s intended mainly for teens.

[Fishnut]

I was made to do age verification to view an Ask Historians post on Reddit.

I am appalled at the way this law has been implemented. I don't understand why my - a single woman in her 40s - internet experience has to be curtailed because of "think of the children".

I may not be a typical internet user but I can count on one hand the number of times I have inadvertently stumbled onto p.rn. The only time it's been a problem is when Twitter changed to X and all of a sudden I got a swarm of sexbots following me. But that isn't me seeking them out and shouldn't require restricting my online experience for something that is clearly Twitter's problem.

I hate to go all "get off my lawn" but what happened to parental responsibility? There are are better ways of educating and guiding your kids to have a good internet experience that don't require everyone in the country to prove their age to some anonymous and likely dubious company.

The restriction of important information to kids also can't be overstated. Kids live in a world that is often sh.t. I don't know the number of kids who experience sexual abuse but one stat I found said that 90% were abused by a family member. Where are they going to turn for help? Family who is more likely to side with the abuser than the abused? Or an internet that is now blocked for them?

And even if their lives aren't sh.t the idea that kids who are old enough to have legal sex can't look up anything about it until they're 18 is f.cking ridiculous.

[Boustrophedon]

I hate to go all "get off my lawn" but what happened to parental responsibility? There are are better ways of educating and guiding your kids to have a good internet experience that don't require everyone in the country to prove their age to some anonymous and likely dubious company.

Absolutely. This should be the model in schools too.